There are actually 2 issues here. One is that it appears that the linked server is sending a prepare request before it sends the actual query. We can fix this by adding a SafeToPrepare attribute to the string filter functions and deploying a new release.

The second issue is that the SELECT part of a DRILLTHROUGH query can only return one cell and your query looks like it will return multiple cells. I fixed the SafeToPrepare in the code and tried a local test with the following query: